ChocoCatalia: Solver for ADT-LIA CHCs

• ChocoCatalia is a solver for CHCs over ADTs and LIA that automatically synthesizes catamorphisms to transform recursive data into integer abstractions.
• It employs a counterexample-guided inductive synthesis loop with template-based refinement to capture precise inductive invariants.
• Winning CHC-COMP 2025 in the ADT-LIA category, ChocoCatalia demonstrates superior performance on satisfiable instances through effective model discovery.

Searching arXiv for the cited papers and closely related context on CHC solving over ADTs. Search results for "(Katsura et al., 28 Jul 2025) Automated Catamorphism Synthesis for Solving Constrained Horn Clauses over Algebraic Data Types" ChocoCatalia is a solver for satisfiability of Constrained Horn Clauses (CHCs) over algebraic data types and linear integer arithmetic, commonly denoted ADT-LIA. It is built around the core solver Catalia and operationalizes a specific verification strategy: automatically discovering catamorphisms—generalized folds over recursive data—and using them to abstract ADT-structured CHCs into purely integer CHCs, where mature back-end solvers are stronger. In CHC-COMP 2025, ChocoCatalia won the ADT-LIA category, and the underlying method was introduced in “Automated Catamorphism Synthesis for Solving Constrained Horn Clauses over Algebraic Data Types” (Katsura et al., 28 Jul 2025).

1. Problem class and motivation

A CHC over ADTs has the form

$$\forall \vec{x}.\; H \Leftarrow \varphi \land P_1(\vec{t}_1)\land \cdots \land P_k(\vec{t}_k),$$

where $H$ is either a predicate application $P(\vec{t})$ or $\bot$, $\varphi$ is a quantifier-free constraint in the background theory, the $P_i$ are unknown predicates, and the $\vec{t}_i$ are terms built from variables, constructors, and integer operations. A set of such clauses is satisfiable if all predicate symbols can be interpreted as relations making every clause true. This is the standard encoding used by many program verifiers: CHC satisfiability corresponds to program correctness.

The difficulty increases substantially when variables range over algebraic data types such as Peano naturals, lists, or trees. These clauses naturally express inductive properties—length, sum, parity, height, or constructor-sensitive invariants—but the resulting models often require inductively defined functions or predicates rather than purely arithmetic relations. The central observation behind ChocoCatalia is that many hard ADT invariants are “arithmetic over a fold of the data structure.” If the relevant fold can be discovered automatically, the ADT-heavy problem can be reduced to an integer one without losing satisfiable models (Katsura et al., 28 Jul 2025).

2. Catamorphisms as structured numeric summaries

For a single ADT sort $\delta$ with constructors

$$\mathrm{C}_i : (\mathsf{int}^{m_i} \times \delta^{n_i}) \to \delta,$$

a catamorphism is a function

$\cata : \delta \to \mathbb{Z}^N$

defined by recursion on constructors through a family of structure maps $H$0. Intuitively, $H$1 maps a structured value to a tuple of integers, and each constructor specifies how the tuple for the whole term is assembled from integer constructor arguments and the tuples of recursive subterms.

The paper uses the term approximation degree for the tuple dimension $H$2. Degree $H$3 yields scalar summaries such as list length or sum of elements. Degree $H$4 allows joint summaries such as $H$5. For integer lists, the examples given are: $H$6 for length,

$H$7

for sum, and

$H$8

for the pair $H$9. For Peano naturals with constructors $P(\vec{t})$0 and $P(\vec{t})$1, the familiar size function is represented by

$P(\vec{t})$2

These maps are structure-preserving: the value on a compound term is determined exactly by its constructor, its integer fields, and the values of its recursive children. This makes catamorphisms a natural interface between recursive shape and arithmetic reasoning. ChocoCatalia exploits precisely this interface by searching for catamorphisms capable of expressing the invariant needed by a satisfiable CHC instance (Katsura et al., 28 Jul 2025).

3. Abstraction from ADT-LIA to integer CHCs

Given a catamorphism $P(\vec{t})$3, Catalia transforms a CHC system over ADTs and integers into one over integers alone. The transformation begins by adding a domain predicate $P(\vec{t})$4 for each ADT sort, with constructor clauses of the form

$P(\vec{t})$5

and by inserting $P(\vec{t})$6 into clause bodies for ADT-sorted variables. This ensures that, after abstraction, integer tuples still correspond to actual ADT values.

Each predicate

$P(\vec{t})$7

is replaced by a fresh predicate

$P(\vec{t})$8

ADT variables are mapped to fresh integer tuples, constructors are replaced by their structure maps, and ADT equalities $P(\vec{t})$9 become equalities of integer tuples $\bot$0. Predicate applications are rewritten accordingly. The result is a CHC system purely over integers.

The key guarantee is soundness in the satisfiable direction: if the catamorphism-abstracted system $\bot$1 is satisfiable, then the original system $\bot$2 is satisfiable. Moreover, a model of the abstract system can be lifted back by composition: $\bot$3 Thus abstraction may introduce spurious unsatisfiability, but not spurious satisfiability. This asymmetry is what makes the subsequent refinement loop possible (Katsura et al., 28 Jul 2025).

4. Counterexample-guided catamorphism synthesis

Catalia uses a CEGAR-style loop. It starts from an initial catamorphism, which may be trivial, abstracts the ADT-LIA system to integer CHCs, and invokes a back-end solver. If the abstract system is satisfiable, the procedure terminates and reconstructs a model for the original clauses. If the abstract system is unsatisfiable, Catalia extracts a resolution proof—specifically from Spacer—and maps it back to a candidate counterexample formula $\bot$4 over the original ADT vocabulary.

The status of $\bot$5 determines the next step. If $\bot$6 is satisfiable in the ADT theory, then the original clauses are genuinely unsatisfiable. If $\bot$7 is unsatisfiable, the abstract refutation was spurious: the current catamorphism forgot too much structure. This is the trigger for refinement.

Refinement uses template-based synthesis. The structure maps $\bot$8 are instantiated from parameterized templates, mostly linear catamorphisms with affine structure maps. For integer lists, the paper gives the template

$\bot$9

with parameters $\varphi$0. Higher approximation degrees are handled by tuples of such templates. The search explores a predefined sequence of template classes of increasing power, for example $\varphi$1 with parameters in $\varphi$2, then $\varphi$3 in $\varphi$4, then $\varphi$5, and later wider parameter ranges.

Because the synthesis constraints involve universal quantifiers and recursive definitions, Catalia uses a counterexample-guided inductive synthesis loop. It alternates between verifying a candidate catamorphism by checking whether the abstracted counterexample formula still fails, and synthesizing new parameter assignments by accumulating constraints in a cache $\varphi$6 and solving them with an SMT solver for NIA. The implementation is described as sound but not guaranteed complete in practice, although the paper discusses relative and refutational completeness under stronger fairness and search assumptions (Katsura et al., 28 Jul 2025).

5. Catalia, ChocoCatalia, and competing approaches

Catalia is the core solver implementing automated catamorphism synthesis for ADT-LIA CHCs. Its back-end portfolio consists of mature integer CHC solvers, specifically Spacer/Z3, Eldarica, and Hoice. ChocoCatalia packages and extends this core. The paper states that ChocoCatalia uses Catalia as a core component for ADT-LIA CHCs and also incorporates another independent and complementary technique not described there. In CHC-COMP 2025, the resulting tool won the ADT-LIA category (Katsura et al., 28 Jul 2025).

The distinction from prior ADT-aware CHC techniques is explicit. Eldarica is described as having a built-in size abstraction, which is a special catamorphism. RInGen performs finite model finding via uninterpreted functions, without arithmetic folds. Other approaches, such as those of Krishnan et al. and De Angelis et al., use user-supplied or manually provided catamorphisms. Catalia’s distinguishing feature is on-demand synthesis of suitable catamorphisms together with systematic exploitation of strong integer CHC back ends.

This positioning clarifies why ChocoCatalia is especially effective on satisfiable ADT-LIA instances. In those cases, the solver must produce a model whose semantic content is often an inductive numeric summary of recursive data. A fixed size abstraction or purely finite-model approach may be insufficient; synthesized folds can capture quantities such as length, sum, parity-sensitive accumulations, or jointly maintained summaries that are not evident a priori (Katsura et al., 28 Jul 2025).

6. Representative benchmark patterns and worked examples

One benchmark pattern uses Peano naturals and predicates $\varphi$7 and $\varphi$8: $\varphi$9 A natural model is obtained by the size catamorphism

$P_i$0

so that

$P_i$1

The paper describes how a trivial initial catamorphism can lead to a spurious proof containing a formula such as $P_i$2, and how synthesis over the template

$P_i$3

recovers $P_i$4, $P_i$5, $P_i$6, i.e. the intended size fold.

A second example concerns lists where $P_i$7 denotes that the sum at even positions is $P_i$8 and the sum at odd positions is $P_i$9, together with a generator $\vec{t}_i$0 that builds lists of pairs $\vec{t}_i$1: $\vec{t}_i$2 The required fold is

$\vec{t}_i$3

This catamorphism computes “even minus odd sum.” In the abstract system, one model is

$\vec{t}_i$4

Lifting this model back yields

$\vec{t}_i$5

The example illustrates the characteristic use case: a recursive data state can be summarized by a small integer tuple once the correct catamorphism is available (Katsura et al., 28 Jul 2025).

7. Empirical profile, guarantees, and scope

The experimental evaluation uses the ADT-LIA division of CHC-COMP 2024: 300 instances, both SAT and UNSAT, with a 300-second time limit on Intel Xeon Gold 6242 hardware with 64 GB RAM. The comparison includes Catalia, RInGen, Spacer, and Eldarica (Katsura et al., 28 Jul 2025).

Tool	SAT solved	UNSAT solved
Catalia	67	80
RInGen	54	46
Spacer	48	86
Eldarica	50	87

Catalia solved 147 of 300 instances overall, compared with 100 for RInGen, 134 for Spacer, and 137 for Eldarica. On satisfiable instances it was the strongest system in the comparison, with 18 uniquely solved SAT cases; the corresponding numbers were 14 for RInGen, 3 for Spacer, and 1 for Eldarica. On UNSAT instances, Spacer and Eldarica were slightly stronger, with 86 and 87 solved respectively against Catalia’s 80. The paper interprets this asymmetry as a consequence of task structure: satisfiable ADT-LIA instances often require discovering precise inductive models, whereas unsatisfiable instances can be refuted without sophisticated fold-based invariants.

The theoretical guarantees explain this profile. Besides the satisfiable-direction soundness theorem, the paper characterizes the abstract domain predicate $\vec{t}_i$6 as exactly the image of the catamorphism in the least model of the abstract CHCs: $\vec{t}_i$7 holds iff $\vec{t}_i$8 for some ADT term $\vec{t}_i$9. It also states relative and refutational completeness informally under stronger assumptions, including fair back-end proof search and exhaustive exploration of bounded template spaces.

The implementation constraints are equally explicit. Current templates are linear, with bounded parameter ranges; properties involving the last element of a list or non-linear arithmetic relationships are not easily expressible. This is given as one reason why RInGen can solve some instances that Catalia cannot. The current focus is ADT-LIA rather than richer combinations such as non-linear arithmetic, arrays, or maps. The practical system also uses timeouts in synthesis and verification, so some guarantees are heuristic in execution rather than absolute.

A terminological caution is occasionally useful. The lexical similarity between ChocoCatalia and the combinatorial paper “Cataland: Why the Fuss?” is superficial: that work studies noncrossing partitions, clusters, sortable elements, positive Artin monoids, and hereditary Artin algebras, not CHC solving or ADT-LIA verification (Stump et al., 2015). Within automated reasoning, ChocoCatalia denotes the competition tool whose identity is defined by automated catamorphism synthesis for CHCs over recursive data (Katsura et al., 28 Jul 2025).